In the cookie protocol, when is a Set-Cookie header typically sent?

• A. Browser sends a POST with credentials
• B. Server sends a response with a Set-Cookie header field
• C. Browser stores cookie automatically after page load
• D. Cookies are created only on logout

Answer: (B)

Cookies are created when the server tells the browser to store them, using a Set-Cookie header in an HTTP response. After the browser makes a request (such as submitting login credentials or loading a page), the server can respond with Set-Cookie to establish a session or remember state. The browser then saves the cookie and sends it back in future requests to the same domain, using the defined path and domain, and honoring attributes like HttpOnly, Secure, and SameSite.

So the typical moment you see a Set-Cookie header is in the server’s response to a client request. It isn’t something the browser sends on its own, it doesn’t happen just because a page loads, and cookies aren’t created only during logout.